1. Our Privacy Policy

1.1 Regent’s International School, Bangkok (“RISB”) is committed to safeguarding personal data in accordance with the Personal Data Protection Act B.E 2562 (2019) of Thailand (“PDPA”). This privacy notice is addressed to parents or guardians that are responsible for one or more prospective, past or present student of RISB. It explains how we collect and use your personal data and the personal data of each student you are responsible for during the course of our provision of educational and related services.

1.2 This privacy notice is intended to explain our privacy practices and covers the following areas:
● what personal data we process;
● how we use your personal data;
● use of sensitive personal data / criminal convictions data;
● transmission, storage and security of personal data;
● rights relating to personal data;
● changes to our privacy notice; and
● definitions, lawful bases and contact details.

1.3 By providing your information, or the information of any student you are responsible for (whether via our website, in person, in writing or over the phone) to us, you acknowledge the processing set out in this privacy notice. Where required by the PDPA, we will seek your explicit consent for
certain activities (for example, where we process sensitive personal data (see Section 4) or use non-essential cookies (see Section 3 and Section 5).

1.4 Most of the processing activities set out in this privacy notice are undertaken by our school. Limited processing activities are undertaken by NAE itself, as the ultimate owner of the schools. The exact split differs between schools, students and over time. We can confirm which processing activities are undertaken by which entity, on request of a student or the parent or guardian of a minor student. Contact details can be found at Appendix 3.

1.5 This privacy notice only relates to processing undertaken by or on behalf of RISB and NAE. Whilst our websites may contain links to other third-party websites, please note that we do not accept any responsibility or liability for their policies in relation to any personal data or their collection
or processing of any personal data. We encourage you to review the privacy notices of such third parties.

2. What Personal Data do we process?
We may collect and process the following personal data about you and any student you are responsible for:
(a) Biographical and identification information ► including name, gender, nationality, date and place of birth, details of family members, passport and national identity information;

(b) Contact information ► including address(es), telephone number(s), email address(es), emergency contacts;

(c) Student information► this includes admission information (e.g. test scores), start date, year group, class information, school ID, grades, transcripts of public exams, copies of assignments, classroom observations, information about class participation, learning skills, notes, timetables, transport routes, photographs or videos, and communications with parents or guardians, teachers and other students and information relating to reports made by/concerning student (e.g. bullying reports etc.). (We use photographs/videos for identification and safeguarding by staff. We do not
use automated biometric identification. If biometric processing is introduced in future, we will provide a separate notice and obtain any consents/meet PDPA exceptions as required.)

(d) Financial information ► including bank account and credit/debit card information, and, where applicable, the results of any relevant checks;

(e) Our correspondence ► where we are contacted by you or a student you are responsible for, we will keep a record of that correspondence; 

(f) Website and communication usage ► details of visits to our websites (including use of any educational tools) and information collected through cookies and other tracking technologies including, but not limited to, IP address and domain name, browser version and operating system, traffic data, location data, web logs and other communication data, resources that are accessed and associated telemetry data (e.g. how long you spent watching a video);

(g) Information you have provided to us ► any additional information that you or a student you are responsible for may provide to us, such as through completing enquiry or feedback forms.

(h) Sensitive Personal Data ► we are, in certain very limited circumstances, required to collect, process and disclose sensitive personal data: please see Section 4 for further information. 

3. How we use your Personal Data 

3.1 We may process your personal data (and that of any student you are responsible for) manually or electronically (including through our learning tools, which may use the latest technologies such as machine learning). 

3.2 Personal data will only be processed where we have a specific purpose, and a lawful basis, for doing so. Where we rely on legitimate interests, we assess necessity, proportionality and the impact on students’ rights, taking into account the age and context of the data subjects. These purposes and bases are listed below:

(a) to select, onboard and enrol students ► to process application forms, tests, interviews, travel arrangements and all activities relating to the student’s enrolment in a school (where photographs/video are used for identification/security see Section 4);

Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services). Where we need to process Sensitive Personal Data, we rely on explicit consent or another PDPA-permitted exception (see Section 4). (b) to manage the student’s academic, sporting and boarding timetable and to provide access to the school’s communication networks ► to schedule the student’s activities.  

and provide access to the school’s intranet and other information storage communication tools; Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services) 

 (c) to develop and support students ► to assess and coach students through dialogue, analysis and record keeping, to support all aspects of their development (including providing insights to students regarding their performance, recording academic progression, helping students understand how they learn and proposing techniques to improve learning) and to assess their suitability for current and future internal and external opportunities. This may, in limited cases, require processing Sensitive Personal Data, such as:

(i) religious beliefs, ethnicity and race, so that students can observe religious/cultural celebrations; and
(ii) sex life or orientation, so that we can advise and respond to any sensitive issues that may arise.

Lawful bases: legal obligation (where applicable under Thai law); contract performance; legitimate interests (to enable us to perform our obligations and provide our services); consent (where this information is gathered via cookies or similar technologies). For any Sensitive Personal Data, we rely on explicit consent or a PDPA exception (e.g. a substantial public interest, vital interests) as applicable.

(d) to provide a safe and healthy environment for students and staff ► such as:
(i) health data, to make provision for disabilities, allergies, illnesses and injuries, including the provision of such information to third parties such as insurers or medical professionals where appropriate; or

(ii) details of criminal offences (including alleged criminal offences), so that we can address serious behavioural or safeguarding issues and liaise with competent authorities where required by law. We process such data only where authorised by Thai law or permitted under a PDPA exception (e.g. legal claims or substantial public interest) and apply PDPC‑mandated enhanced safeguards.
Lawful bases: contract performance; legal obligations; legitimate interests (to enable us to perform our obligations and provide our services). For Sensitive Personal Data, we rely on explicit consent or PDPA exceptions (e.g. vital interests where the student cannot consent; substantial public interest) and we apply enhance safeguards set by the PDPC for criminal record data.

(e) to conduct extra-curricular programs ► to organise, administer and operate extra curricular expeditions and activities, including processing payment, which may include passing personal data to third parties for relevant insurance cover, medical assistance, supervision and execution of activities;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services). For any Sensitive Personal Data, see Section 4.

(f) to keep parents and guardians informed about students ► to keep parents updated on students’ progress (including by providing reports, note correspondence and access to learning systems (e.g. parent portal), opportunities and any issues. In conjunction with students, parents or guardians, liaise with other bodies (educational, sporting or any other sector) in relation to students; Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services); consent (where this information is gathered via cookies or similar technologies).

(g) to provide newsletters and marketing materials ► to provide you and any students you are responsible for with updates and offers relating to our products and services, where you have chosen to receive these. We rely on consent for direct marketing, especially where communications may involve students. You can withdraw consent at any time without affecting core school services 

Lawful base: consent.

(h) to ensure that we are paid ► where required, to recover any payments due to us and where necessary to enforce such recovery through the engagement of third party debt collection agencies or taking legal action (including the commencement and carrying out of legal and court proceedings);
Lawful bases: contract performance; legal claims; legitimate interests (to ensure that we are paid for our services).
(i) to improve our services ► to analyse personal data in order to better understand your requirements, or those of any student you are responsible for. This will assist us in tailoring and developing the services we offer; 

Lawful bases: legitimate interests (to allow us to improve our services). 

(j) to support, develop and improve our teaching ► to analyse pseudonymised personal data in order to gather insights regarding our teaching which we use to support, develop and improve our teaching including to help us understand and develop our curriculum and to develop and improve our educational products (including our technology tools). The resulting insights, learnings and products (but not the underlying personal data) may be used for education related commercial purposes;
Legal basis: legitimate interests (to allow us to improve our educational products and services); consent (where this information is gathered via cookies or similar technologies).

(k) to monitor certain activities ► limited monitoring of school systems and accounts to ensure student safety, prevent bullying or misuse, protect network security, and comply with law and school policies;
Lawful bases: legal obligations; legal claims; legitimate interests (to ensure that the quality and legality of our services)

(j) to support, develop and improve our teaching ► to analyse pseudonymised personal data in order to gather insights regarding our teaching which we use to support, develop and improve our teaching including to help us understand and develop our curriculum and to develop and improve our educational products (including our technology tools). The resulting insights, learnings and products (but not the underlying personal data) may be used for education related commercial purposes;
Legal basis: legitimate interests (to allow us to improve our educational products and services); consent (where this information is gathered via cookies or similar technologies).

(k) to monitor certain activities ► limited monitoring of school systems and accounts to ensure student safety, prevent bullying or misuse, protect network security, and comply with law and school policies;
Lawful bases: legal obligations; legal claims; legitimate interests (to ensure that the quality and legality of our services). 

(l) to ensure website content is relevant ► to ensure that content from our websites are presented in the most effective manner for you and any student you are responsible for;

(m) to reorganise or make changes to our business ► in the event that we are (i) subject to negotiations for the sale of our business or part thereof to a third party, (ii) is sold to a third party or (iii) undergo a re-organisation, we may need to transfer some or all of your and your student(s)’ personal data to the relevant third party (or its advisors) as part of any due diligence process or transferred to that re-organised entity or third
party and used for the same purposes as set out in this privacy notice or for the purpose of analysing any proposed sale or re-organisation;
Lawful basis: legitimate interests (to allow us to change and develop our business). 

(n) in connection with legal or regulatory obligations ► we may process your personal data or that of any student you are responsible for to comply with our regulatory requirements or to engage in dialogue with our regulators. This may include disclosing that personal data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so;

Lawful bases: contract performance; legal obligation; legitimate interests (to ensure the safety and proper functioning of the school). 

3.3 We may also process personal data (including Sensitive Personal Data) where necessary in relation to the establishment, exercise or defence of legal claims.

Sharing Personal Data with other Organisations

3.4 In order to provide our education and schooling services (including extra-curricular activities) effectively, we sometimes need to share information with other organisations. We share information with the following entities: 

(a) NAE’s regional office teams, which undertake management functions; and

(b) our suppliers, who assist us in providing educational and extra-curricular services, including after-school programmes, catering, transportation, our programme partners Julliard, MIT and UNICEF, and IT contractors who help us develop our products and services. A list of our suppliers can be provided upon request by contacting us;

3.5 Where these entities are outside Thailand, we will only transfer personal data in accordance with the PDPA’s cross-border transfer rules (see Section 5: Cross-Border Transfers). 

4. Use of Sensitive Personal Data
4.1 As a general rule, we do not process Sensitive Personal Data of students, parents or guardians. However, to provide our education and schooling services (including extra-curricular activities) effectively to you and any student you are responsible for, we are, in certain very limited circumstances, required to collect, process and disclose such personal data. In accordance with the PDPA, we will only process Sensitive Personal Data where i) explicit consent has been obtained, or ii) a PDPA-permitted exception applies (such as protection of life/health where the student cannot consent, legal claims or substantial public interest permitted by law), and we will ensure appropriate security measures are in place. The categories of data we may need to process include the following closed list:

(a) health/medical information (e.g. allergies, disabilities, dietary requirements, records of accidents and illnesses) so that we can maintain a safe environment for all students and respond appropriately to medical or welfare needs;
(b) religious beliefs, ethnicity and race, so that students can observe religious/cultural celebrations and we can provide respectful and appropriate accommodations;
(c) sex life or orientation, so that we can advise and respond to any sensitive issues that may arise in relation to safeguarding, pastoral care or student wellbeing;
(d) photographs and video footage of students, (for identification or security purposes). Where such images are used for identification and may constitute biometric Sensitive Personal Data, explicit consent or a PDPA‑permitted exception will apply. For general safety, operational or administrative purposes, images will be processed only where necessary and in line with the PDPA’s requirements; and
(e) details of criminal offences (including alleged criminal offences), so that we can address serious behavioural or safeguarding issues and liaise with competent authorities where required by law. We process such data only where authorised by Thai law or permitted under a PDPA exception (e.g. legal claims or substantial public interest) and apply PDPC‑mandated enhanced safeguards. 

4.2 In addition to our general organisational, technical and physical measures, we apply enhanced safeguards to Sensitive Personal Data, in accordance with PDPC regulations (e.g. strict access control, logging/audit, encryption, retention limits and periodic reviews.

4.3 Where we must process Sensitive Personal Data, we will do so only in accordance with the PDPA. This will generally be on the basis that we have obtained the data subject’s explicit consent, or that such processing is necessary to protect the vital interests of a student where the student is unable to give consent, or – specifically for the Sensitive Personal Data – that it is necessary for reasons of substantial public interest as permitted under the PDPA and relevant PDPC regulations.

4.4 Where a student is under 20, we normally seek consent from a parent or legal guardian. Where the student has sufficient understanding in relation to a specific processing activity, we may also seek the student’s consent directly, or together with parental consent. If consent is declined or
withdrawn, we may continue processing if permitted by another lawful basis under the PDPA (e.g., legal obligation, vital interests). We do not rely on consent where the PDPA requires another legal basis.

4.5 You (or the student you are responsible for, as applicable) are free to withdraw your consent at any time by contacting us. However, where you do so, we may not be able to provide a service that requires the use of such data. 

4.6 We may obtain personal data from you (or any student you are responsible for) directly, or from third parties such as other educational or sporting institutions, insurers or medical providers (for safety), and other partners, in accordance with the PDPA.

5. Transmission, Storage and Security of Personal Data

Security over the Internet

5.1 No data transmission over the Internet or through a website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal data, and that of any student you are responsible for, in accordance with the PDPA and applicable PDPC guidance.
5.2 All information you, or any student you are responsible for, provide to us is stored on our or our suppliers’ secure servers and accessed and used subject to our security policies and standards.
We ask that you, or any student you are responsible for:
❖ refrain from sharing any password providing access to certain parts of our websites, applications or systems with any other person; and
❖ comply with any other security procedures that we may notify you of from time to time. 

Cross-Border Transfers (Export outside Thailand)

5.3 We are part of a global network of schools, and your personal data, or that of any student you are responsible for, may be transferred to, stored in or accessed by staff or suppliers in, a destination outside Thailand. We will only transfer personal data in accordance with the PDPA, including where: i) the destination has adequate personal data protection standards, as prescribed by the PDPC; appropriate safeguards are in place (e.g. PDPA-compliant contractual clauses or binding corporate rules); or iii) a PDPA exception applies (e.g. explicit consent; necessity for contract performance; vital interests; legal claims; or other grounds permitted by law).
5.4 If you would like to understand more about where your personal data is located, or to see a copy of the safeguards applied to cross-border transfers, please contact us (see Appendix 3).

Storage Limits
5.5 We will retain personal data for as long as is necessary for the processing purpose(s) for which it was collected and any related legitimate purpose (e.g. applicable limitation periods or legal retention requirements). We restrict access to those who need to use the data for relevant purposes and will cease processing for purposes whose retention period has expired).
5.6 Our retention periods are based on business needs and relevant laws. Records that are no longer needed are either irreversibly anonymised (and the anonymised information may be retained) or securely destroyed. Examples of retention periods (e.g. student records, safeguarding
files, health records) are available on request or set out in our internal retention schedule.

6. Rights relating to Personal Data
Be aware of the rights that data subjects have in relation to their personal data.
6.1 Under the PDPA, data subjects have a number of rights relating to how their personal data is used. Please be aware that certain exceptions apply to the exercise of these rights, and we will respond within the period and according to the criteria prescribed by the PDPA/PDPC.
6.2 Students may be able to exercise these rights independently, provided that they have Legal Capacity.
6.3 You have, to the extent applicable, the following rights relating to your personal data (and may exercise these rights on behalf of a student you are responsible for):
• The right to be informed about the purpose of collecting and processing the data.

• The right to withdraw the given consent.
• The right to access and obtain the data collected from you.
• The right to object the collection, use, and disclosure of your data.
• The right to restrict the use of your data.
• The right to correction of your data.
• The right to transfer your data to another data controller.
• The right to have your data erased, destroyed, or anonymized.
6.4 If you would like to exercise any of your rights or have any queries relating to your rights or exercise of your rights, please contact us using the details set out at Appendix 3.
6.5 You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC), Thailand’s data protection authority: https://www.pdpc.or.th
7. Changes to our Policy
7.1 This privacy notice was last updated on 25 January 2026.

 Appendix 1: Definitions
The following terms are used in this privacy notice:
● Personal Data: information relating to a natural person that enables identification directly or indirectly (excluding data of deceased persons). An identifiable person is one who can be identified (either directly or indirectly) by reference to an ‘identifier’.
● Sensitive Personal Data: data pertaining to racial/ethnic origin, religious or philosophical beliefs, sexual behaviour/ sexual orientation, health data, disability, trade union information, genetic data, biometric data, criminal records, or other data designated by the PDPC that may similarly affect the data subject.
● Data Controller: this is the person which alone or jointly with others determines the purpose and means of the processing of personal data. RISB is the data controller of all employment details used in its business.
● Data Subject: for the purpose of this policy this includes all living individuals about whom we hold personal data, including employees, students, parents or guardians, suppliers and business partners.
● Data Processor: this is the person who processes personal data on behalf of the data controller (not including employees of the data controller). RISB’s suppliers and agencies that handle personal data on our behalf will be data processors.
● Guardians / Parents: this means any parents or guardians responsible for a student.
● RISB, Our, Us, We, School: Regent’s International School Bangkok.
● NAE: our UK based Headquarters, Nord Anglia Education, Nova South, 160 Victoria Street,
Westminster, London, SW1E 5LB, United Kingdom (which includes each of the companies
and schools listed on our website)
● Student: this means any prospective, past or present student of a RISB.

Appendix 2: Contacting us: Nord Anglia Education Companies and Schools